In RPKI, what is the role of trust anchors?

• A. End-to-end encryption of BGP sessions
• B. The authority to enforce ROA deletions
• C. The ability to override ROA decisions
• D. Root certificates that sign ROAs; establish chain of trust for route validation

Answer: (C)

Trust anchors are the root of trust for the RPKI. They are root certificates that sign ROAs (and certify the intermediate certificates in the hierarchy), creating a chain of trust that validators use to verify which origins are authorized to announce prefixes. This chain of trust is what lets validators confirm ROA signatures and thus validate route announcements in BGP. They are not about encrypting BGP sessions, nor about enforcing deletions or overriding ROA decisions. The core role is establishing and sustaining the trust path that underpins route validation by signing ROAs and enabling validators to trust the published authorizations.